Information processing apparatus, security management method and information processing system that switches from one monitoring unit to another in accordance with operating mode

• US 10,049,233 B2
• Filed: 09/18/2015
• Issued: 08/14/2018
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Canon Hi-Tech Limited (Canon Inc.)
• Original Assignee: Canon Hi-Tech Limited (Canon Inc.)
• Inventors: Sekiguchi, Azusa
• Primary Examiner(s): Moorthy, Aravind K
• Application Number:
  US14/858,262
• Publication Number:
  US 20160105451A1
• Time in Patent Office: 1,061 Days
• Field of Search: 726 22, 713165, 713188, 717127, 717128
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

When security software is activated, it is determined whether the mode is a safe mode or a normal mode. And the security software switches a monitor in accordance with the mode.

Claims

1. An information processing apparatus that operates in one of a normal mode that is a normal program execution mode and a safe mode in which a predetermined minimum software module is executed, the apparatus comprising:

at least one memory; and

at least one processor that, when executing instructions stored in the at least one memory, performs the functions of;

a determination unit that determines whether an operating mode is the safe mode or the normal mode; and

a management unit that manages security of the information processing apparatus,

wherein when the operating mode is determined to be the normal mode by the determination unit, the management unit uses a first unit configured to monitor the information processing apparatus, the first unit monitoring a first resource that is allowed to be used in the normal mode, and when the operating mode is determined to be the safe mode by the determination unit, the management unit uses a second unit configured to monitor the information processing apparatus, the second unit monitoring a second resource that is allowed to be used in the safe mode,

wherein the management unit controls use of a device connected to the information processing apparatus by, in the normal mode, the first unit monitoring a file system as the first resource and by, in the safe mode, the second unit monitoring a device manager as the second resource.

2. The apparatus according to claim 1, wherein the security managed by the management unit includes a possibility of connection of the device, and in accordance with the mode determined by the determination unit, the management unit uses either the first unit or the second unit to monitor the connection of the device.

3. The apparatus according to claim 2, wherein when the determining unit determines that the operating mode is the safe mode, the second unit monitors the connection of the device by monitoring a message representing the connection of the device.

4. The apparatus according to claim 2, wherein in a case where use of the device whose connection is detected is prohibited, if the determination unit determines that the operation mode is the safe mode, the management unit sets the device in an unusable state, thereby prohibiting use of the device.

5. The apparatus according to claim 4, wherein in the case where use of the device whose connection is detected is prohibited, if the determination unit determines that the operating mode is the safe mode, the management unit further notifies a user of a message representing that use of the device is prohibited.

6. The apparatus according to claim 5, wherein after input/output to/from the device is blocked, if the device is detached from the information processing apparatus, the management unit cancels the block.

7. The apparatus according to claim 5, wherein after input/output to/from the device is blocked, unless the device is detached from the information processing apparatus within a predetermined time, the management unit makes a user log off who has logged in, or shuts down the information processing apparatus.

8. The apparatus according to claim 2, wherein in a case where use of the device whose connection is detected is prohibited, if the determination unit determines that the operating mode is the safe mode, the management unit blocks input/output to/from the device, thereby prohibiting use of the device.

9. The apparatus according to claim 1, wherein the security managed by the management unit includes a possibility of network access, the management unit further controls a network access, and in accordance with the mode determined by the determination unit, the management unit uses a unit configured to monitor the network access.

10. The apparatus according to claim 9, wherein the management unit records the network access monitored by said unit configured to monitor the network access.

11. The apparatus according to claim 1, wherein the security managed by the management unit includes a possibility of activation of a process, the management unit further controls activation of a process, and in accordance with the mode determined by the determination unit, the management unit uses a unit configured to monitor the activation of the process.

12. The apparatus according to claim 1, wherein the security managed by the management unit includes a possibility of login, the management unit further controls login, and in accordance with the mode determined by the determination unit, the management unit uses a unit configured to monitor the login.

13. The apparatus according to claim 1, wherein the security managed by the management unit includes a possibility of file sharing, the management unit further controls file sharing, and in accordance with the mode determined by the determination unit, the management unit uses a unit configured to monitor the file sharing.

14. The apparatus according to claim 1, wherein a unit monitors at least one of a packet, activation of a process, activation of Windows, login of a user, and an SMB service.

15. The apparatus according to claim 1, wherein one of the first and second unit starts monitoring the information processing apparatus as the normal mode or the safe mode is activated.

16. The apparatus according to claim 1, wherein the device of the information processing apparatus controlled by the management unit is a detachable storage medium.

17. A security management method in an information processing apparatus that operates in one of a normal mode that is a normal program execution mode and a safe mode in which a predetermined minimum software module is executed, comprising:

determining whether an operating mode is the safe mode or the normal mode; and

managing security of the information processing apparatus,

wherein in the managing step, when the operating mode is determined to be the normal mode in the determining step, a first unit is used to monitor the information processing apparatus, the first unit monitoring a first resource that is allowed to be used in the normal mode, and when the operating mode is determined to be the safe mode in the determining step, a second unit is used to monitor the information processing apparatus, the second unit monitoring a second resource that is allowed to be used in the safe mode,

wherein in the managing, use of a device connected to the information processing apparatus is controlled by, in the normal mode, the first unit monitoring a file system as the first resource and by, in the safe mode, the second unit monitoring a device manager as the second resource.

18. An information processing system that operates in one of a normal mode that is a normal program execution mode and a safe mode in which a predetermined minimum software module is executed, the system comprising:

at least one memory; and

at least one processor that, when executing instructions stored in the at least one memory, performs the functions of;

a determination unit configured to determine whether an operating mode is the safe mode or normal mode; and

a security management unit configured to manage security of the information processing system,

wherein when the operating mode is determined to be the normal mode by the determination unit, said security management unit uses a first method of monitoring the information processing system, the first method monitoring a first resource that is allowed to be used in the normal mode, and when the operating mode is determined to be the safe mode by the detection unit, said security management unit uses a second method of monitoring the information processing system, the second method monitoring a second resource that is allowed to be used in the safe mode,

wherein the management unit controls use of a device connected to the information processing apparatus by, in the normal mode, the first unit monitoring a file system as the first resource and by, in the safe mode, the second unit monitoring a device manager as the second resource.

19. A non-transitory computer-readable storage medium recording a program, the program executing a procedure of causing a computer to operate in one of a normal mode that is a normal program execution mode and a safe mode in which a predetermined minimum software module is executed, the procedure comprising:

determining whether an operating mode is the safe mode or the normal mode; and

managing security of the computer,

wherein in the managing step, a first or second method of monitoring the computer is used, and

wherein the first method is used when the operating mode is determined to be the normal mode in the determining, the first method monitoring a first resource that is allowed to be used in the normal mode, and the second method is used when the operating mode is determined to be the safe mode in the determining, the second method monitoring a second resource that is allowed to be used in the safe mode,

wherein in the managing, use of a device connected to the information processing apparatus is controlled by, in the normal mode, the first method monitoring a file system as the first resource and by, in the safe mode, the second method monitoring a device manager as the second resource.